Outbound Compliance: Consent, Do-Not-Call, CAN-SPAM

• Outbound laws charge per call, text or email, so small errors multiply fast.
• Marketing calls and texts made with an autodialer or an artificial voice need prior express written consent.
• AI-generated voices count as artificial voices under federal law, with the same consent and disclosure rules.
• Opt-outs must be accepted any reasonable way and honored within 10 business days.
• Florida's own law covers any call or text to a Florida number, with stricter limits on hours and attempts.
• Email is opt-out based, but every message needs a real address, a truthful subject line and a working unsubscribe.

This guide covers the rules that apply in 2026: consent for calls and texts, AI-generated voices, opt-outs, Do-Not-Call lists, Florida's own law and email. Several of these rules changed in 2025, and some are still moving. Put plainly: build every sequence as if a regulator will read it, because a plaintiff's lawyer might.

This is general information, not legal advice. Telemarketing rules differ by state and by channel, they change often, and how they apply depends on your facts. Confirm your consent language, scripts and sequences with counsel before you launch.

The math is per message. Under the Telephone Consumer Protection Act (TCPA), each unlawful call or text can cost $500, and up to $1,500 if the violation was willful. Under CAN-SPAM, each non-compliant email can carry a civil penalty of up to $53,088.

That number is current. In September 2026 the FTC announced it would not adjust its penalties for inflation this year and would keep the 2025 levels.

Class actions follow volume. A sequence that sends 5,000 texts with one flaw is not one mistake. It is 5,000. Plaintiffs' firms know this, and they search for it.

Carriers and inbox providers enforce too. Phone carriers block or flag numbers that draw complaints. Email providers send messages to spam when people mark them as junk. A campaign can fail commercially long before anyone sues.

So the rules belong in the system. The way to stay compliant at volume is to build the rules into the tools that send. Good intentions don't scale; a consent check in the dialer does. The pipeline approach in outbound without a sales floor assumes this from the start.

Two kinds of consent. Informational calls and texts made with an autodialer or an artificial or prerecorded voice need the recipient's prior express consent. Marketing calls and texts made that way need prior express written consent: a signed agreement, which can be electronic, that clearly authorizes marketing contact from you.

Record exactly what they agreed to. Keep the wording the person saw, the date and time, the page or form, and the phone number they gave. If you can't show it, assume a court will treat it as missing.

The one-to-one rule is gone, but not everywhere. The FCC had planned to require consent for one seller at a time. In January 2025 the Eleventh Circuit struck that rule down in Insurance Marketing Coalition v. FCC. Many carriers and texting platforms still ask for one-to-one style consent as their own business rule, so check your vendors' terms.

Calling hours. Federal rules limit telephone sales calls to between 8 a.m. and 9 p.m. in the recipient's time zone. Some states are stricter, including Florida, below.

Who is calling. Calls must identify the business making them. Prerecorded and artificial-voice messages must state the business name at the start and give a way to opt out.

The ruling. In February 2024 the FCC ruled unanimously that AI-generated voices are "artificial" voices under the TCPA (FCC announcement). An AI calling agent is treated like any other robocall.

What that means for AI outbound. An AI voice call needs prior express consent. If it is a marketing call, it needs prior express written consent. It must identify who is calling and, for marketing calls, offer an opt-out.

No live-agent exception. The FCC said there is no carve-out for technology that claims to work like a live agent. A voice that sounds human is still an artificial voice.

More may be coming. The FCC has proposed further disclosure rules for AI-generated calls and texts. Check their status with counsel before you launch an AI voice program. The channel trade-offs are covered in voice, chat, SMS and WhatsApp.

Any reasonable way. Since April 11, 2025, people can revoke consent any reasonable way. Replying "stop," "quit," "end," "revoke," "opt out," "cancel" or "unsubscribe" counts. So does saying it on a call or writing it in an email. You can't name a single method as the only one that works.

Ten business days. You must honor an opt-out within a reasonable time, and no later than 10 business days after you receive it.

One confirmation, no pitch. You may send one text confirming the opt-out, within five minutes, with no marketing in it.

If your texts can't take replies. Say so in every message, and give another clear way to opt out.

Revoke-all is delayed, not dead. A further FCC rule would make an opt-out from one type of message stop all messages from your business. It was pushed back to January 31, 2027 while the FCC considers changes. The other revocation rules are already in force.

Build for the strict version anyway. Treat any opt-out as an opt-out from every marketing channel you run. It is simpler to operate, and you won't need to rebuild if the rule takes effect.

The national registry. Marketing calls to numbers on the National Do Not Call Registry need consent or an existing business relationship. Telemarketers must check the registry at least every 31 days, and the protections cover marketing texts as well as calls.

Your internal list. Anyone who asks you to stop calling goes on your own do-not-call list. That list must be honored within 10 business days and kept across every campaign and vendor.

State lists and rules. Several states run their own do-not-call lists or add rules on top of the federal ones. If you call into many states, your system needs to know which rules apply to each number.

One suppression list for everything. Opt-outs, do-not-call requests and bounced numbers should live in one list that every tool checks before it sends. That record layer is the same foundation described in the foundation every AI project needs.

Who it covers. The Florida Telephone Solicitation Act (FTSA) applies to sales calls and texts to Florida area codes, wherever the caller is (Fla. Stat. § 501.059). For a Miami business, it applies to most of your list.

What it requires. Unsolicited sales calls and texts made with an automated system need prior express written consent. Since 2023, checking a box or replying yes to a text can count as the signature.

What the 2023 changes did. The law now applies only to unsolicited calls, not to existing customers or people who contacted you first. Its definition of an automated system is narrower. And before suing over texts, a person must reply "STOP" and give you 15 days to stop.

The limits that still bite. No sales calls after 8 p.m. And no more than three attempts in 24 hours on the same subject. Your sequence tool must enforce both for every Florida number.

Spanish is not an exemption. The rules apply in every language. Consent language, opt-out handling and disclosures must work the same way in English and Spanish.

Opt-out based, not opt-in. CAN-SPAM does not require consent before a marketing email. It sets rules for every email you send. The FTC's compliance guide lists them:

• Accurate "from," "to" and routing information
• Subject lines that don't mislead about the content
• Clear notice that the message is an ad, unless the recipient agreed to receive it
• A valid physical postal address for your business
• A clear way to opt out, honored within 10 business days
• Responsibility for what agencies and vendors send on your behalf

The unsubscribe must keep working. It must function for at least 30 days after you send. You can't charge a fee or ask for more than an email address to process it.

B2B is not exempt. CAN-SPAM makes no exception for business-to-business email.

Inbox providers set a higher bar. Gmail and Yahoo require bulk senders to authenticate their domains, offer one-click unsubscribe and keep complaint rates low. Missing those doesn't break the law, but your email won't arrive.

A consent record for every contact. Store the source, date, exact wording, channel and number or address for each person. No record, no marketing call or text.

Checks before every send. The sending tool confirms consent, checks the suppression list, checks the recipient's local time and state rules, and counts recent attempts. If any check fails, the message doesn't go.

Drafts a person approves. AI can write the outreach, but a person reads it before it sends. That review catches misleading subject lines and claims, as covered in drafts humans approve.

Opt-outs that travel. An opt-out on any channel reaches every channel within hours, not days.

An audit trail. Every send, opt-out and consent change is logged with a timestamp, so you can show what happened and when.

Vendor contracts. Lead sellers, dialers and agencies must show how they collected consent and how they handle opt-outs. Their mistakes can become your liability.

Start small. Pilot new sequences on a small segment and review the results before scaling, the approach in AI pilots that fail safely.

Opt-out processing time. Median hours from request to suppression, and the share handled within one business day.

Consent coverage. The share of marketing contacts with a complete, stored consent record.

Suppression sync lag. How long an opt-out on one channel takes to reach the others.

Complaint and block rates. Carrier blocking, spam complaints and unsubscribes per thousand messages.

Registry recency. Days since the last Do-Not-Call scrub, which should never pass 31.

Audit results. A monthly sample of sends checked against consent, hours and attempt limits.

List every channel, tool, vendor and list in use. Pull a sample of consent records and check them against the rules above. Map which numbers are in Florida and other strict states. Review scripts, AI voice use and email templates with counsel.

Create the consent record and the single suppression list. Add pre-send checks for consent, hours, state rules and attempt limits. Set up opt-out handling for every reasonable method, with the five-minute confirmation text. Update email footers and unsubscribe links.

Run a small pilot with all checks live. Track opt-out time, sync lag and complaint rates weekly. Run the first monthly audit sample, fix what it finds, and only then scale the sequence.

Astra Results Marketing builds outbound with compliance in the system, not in a policy document. Every contact gets a consent record, every send passes the same checks, and opt-outs reach every channel quickly.

AI drafts are reviewed by a person before they go out, Florida's limits are enforced for every Florida number, and AI voice programs are set up only with consent and counsel review. Reporting covers opt-out speed, consent coverage and complaint rates alongside pipeline. Engagements begin with an outbound compliance audit through our AI outbound sales team.

Related reading

• AI Outbound Sales: Pipeline Without a Sales Floor
• Speed to Lead: The Metric Nobody Tracks
• Insurance Engagement: Policy Questions and Claims

Yes, in most cases. Marketing texts sent with an autodialer need the recipient's prior express written consent under federal law, and Florida's law adds its own requirements for Florida numbers. Keep a record of exactly what each person agreed to, when and where.

They can be, with consent. The FCC ruled in 2024 that AI-generated voices are artificial voices under the TCPA. That means prior express consent, prior express written consent for marketing, caller identification and an opt-out. There is no exception for AI that sounds like a live agent.

Within a reasonable time and no later than 10 business days for calls and texts, and within 10 business days for email. You must accept opt-outs made any reasonable way, not only by a keyword. Building for same-day processing removes most of the risk.

No. The Eleventh Circuit struck it down in January 2025. Many carriers and texting platforms still require one-to-one style consent as a business rule, so check your vendors' terms and keep consent specific to your business.

Yes. CAN-SPAM makes no exception for business-to-business email. It does not require prior consent, but every message needs accurate headers, a truthful subject line, a physical address and a working opt-out honored within 10 business days.

Yes. The FTSA covers sales calls and texts to Florida area codes, wherever the caller is located. It adds an evening cutoff and a limit of three attempts in 24 hours on the same subject, on top of the federal rules.

Ready to scale outbound without the liability? Astra Results Marketing builds outbound with consent records, single suppression lists and pre-send checks for hours, state rules and attempt limits, with AI drafts approved by a person and every sequence reviewed with your counsel before launch. ▸ CALL (786) 321-2866 · ▸ REQUEST YOUR CONSULTATION